CVE-2025-48055High· 8.5▾ TwilightCombodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.2%
Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.
itop < 3.2.2Upgrade past the affected range:
itop 3.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-48065High· 8.8Combodo iTop is a web based IT service management tool
CVE-2025-47932High· 8.8Combodo iTop is a web based IT service management tool
CVE-2025-47773High· 8.8Combodo iTop is a web based IT service management tool
CVE-2026-108717Medium· 6.3Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters
CVE-2025-48878Medium· 4.3Combodo iTop is a web based IT service management tool
CVE-2025-49145High· 8.7Combodo iTop is a web based IT service management tool